chore: upgrade impress to v6.0.2 (yhub collaboration), nginx to 1.31.8, docspec 1.21.4
cc-ci/testme cc-ci: failure
cc-ci/testme cc-ci: failure
This commit is contained in:
autonomic-bot
+55
-23
@@ -57,7 +57,7 @@ x-common-env: &common-env
|
||||
# Collaboration server (yhub), reached in-stack
|
||||
YHUB_API_BASE_URL: http://yhub:3002
|
||||
# RSA key signing the tokens the backend presents to yhub and y-provider
|
||||
JWT_PRIVATE_KEY_FILE: /run/secrets/jwt_pk
|
||||
JWT_PRIVATE_KEY_FILE: /keys/jwt.pem
|
||||
# Email app URL (used in email templates; matches recipe DOMAIN)
|
||||
DJANGO_EMAIL_URL_APP: "https://${DOMAIN}"
|
||||
# Conversion (file upload → Yjs via y-provider)
|
||||
@@ -72,7 +72,7 @@ x-common-env: &common-env
|
||||
Y_PROVIDER_API_BASE_URL: http://y-provider:4444/api/
|
||||
Y_PROVIDER_API_KEY_FILE: /run/secrets/y_api_key
|
||||
# DocSpec — converts .docx → BlockNote JSON, then y-provider turns that into Yjs
|
||||
DOCSPEC_API_URL: http://docspec:4000/conversion
|
||||
DOCSPEC_API_URL: http://docspec:3000/conversion
|
||||
# Database connection pool
|
||||
DB_PSYCOPG_POOL_ENABLED:
|
||||
# Media auth header (matches recipe nginx by default)
|
||||
@@ -105,7 +105,7 @@ x-yhub-env: &yhub-env
|
||||
COLLABORATION_BACKEND_BASE_URL: https://${DOMAIN}
|
||||
COLLABORATION_SERVER_ORIGIN: https://${DOMAIN}
|
||||
Y_PROVIDER_API_KEY_FILE: /run/secrets/y_api_key
|
||||
YHUB_JWT_PRIVATE_KEY_FILE: /run/secrets/yhub_jwt_pk
|
||||
YHUB_JWT_PRIVATE_KEY_FILE: /keys/yhub-jwt.pem
|
||||
# Seed documents from the pre-v6 media bucket the first time they are opened.
|
||||
# Only turn off once `abra app cmd <app> backend migrate_documents` covered all documents.
|
||||
SOFT_MIGRATION: "${SOFT_MIGRATION:-true}"
|
||||
@@ -120,7 +120,7 @@ x-minio-env: &minio-env
|
||||
|
||||
services:
|
||||
app:
|
||||
image: lasuite/impress-frontend:v6.0.1
|
||||
image: lasuite/impress-frontend:v6.0.2
|
||||
networks:
|
||||
- backend
|
||||
deploy:
|
||||
@@ -137,7 +137,7 @@ services:
|
||||
start_period: 10s
|
||||
|
||||
backend:
|
||||
image: lasuite/impress-backend:v6.0.1
|
||||
image: lasuite/impress-backend:v6.0.2
|
||||
networks:
|
||||
- backend
|
||||
environment:
|
||||
@@ -152,7 +152,9 @@ services:
|
||||
user: "${DOCKER_USER:-1000}"
|
||||
command: ["gunicorn", "-c", "/usr/local/etc/gunicorn/impress.py", "impress.wsgi:application"]
|
||||
entrypoint: >
|
||||
sh -c "if [ \"$$AUTO_MIGRATIONS\" = \"true\" ]; then /migrate.sh; fi && exec /abra-entrypoint.sh /usr/local/bin/entrypoint \"$$@\"" --
|
||||
sh -c "while [ ! -s /keys/jwt.pem ]; do sleep 1; done; if [ \"$$AUTO_MIGRATIONS\" = \"true\" ]; then /migrate.sh; fi && exec /abra-entrypoint.sh /usr/local/bin/entrypoint \"$$@\"" --
|
||||
volumes:
|
||||
- jwt_keys:/keys:ro
|
||||
configs:
|
||||
- source: abra_entrypoint
|
||||
target: /abra-entrypoint.sh
|
||||
@@ -169,10 +171,9 @@ services:
|
||||
- postgres_p
|
||||
- y_api_key
|
||||
- email_pass
|
||||
- jwt_pk
|
||||
|
||||
celery:
|
||||
image: lasuite/impress-backend:v6.0.1
|
||||
image: lasuite/impress-backend:v6.0.2
|
||||
networks:
|
||||
- backend
|
||||
healthcheck:
|
||||
@@ -185,7 +186,10 @@ services:
|
||||
command: ["celery", "-A", "impress.celery_app", "worker", "-l", "INFO"]
|
||||
environment:
|
||||
<<: [*common-env, *postgres-env, *yprovider-env]
|
||||
entrypoint: ["/abra-entrypoint.sh", "/usr/local/bin/entrypoint"]
|
||||
entrypoint: >
|
||||
sh -c "while [ ! -s /keys/jwt.pem ]; do sleep 1; done; exec /abra-entrypoint.sh /usr/local/bin/entrypoint \"$$@\"" --
|
||||
volumes:
|
||||
- jwt_keys:/keys:ro
|
||||
configs:
|
||||
- source: abra_entrypoint
|
||||
target: /abra-entrypoint.sh
|
||||
@@ -199,11 +203,10 @@ services:
|
||||
- postgres_p
|
||||
- y_api_key
|
||||
- email_pass
|
||||
- jwt_pk
|
||||
|
||||
# Collaboration server: serves the websocket and holds the document content
|
||||
yhub:
|
||||
image: lasuite/impress-yhub:v6.0.1
|
||||
image: lasuite/impress-yhub:v6.0.2
|
||||
networks:
|
||||
- backend
|
||||
environment: *yhub-env
|
||||
@@ -216,12 +219,13 @@ services:
|
||||
start_period: 30s
|
||||
# The server never creates its schema: run the idempotent init-db before every start
|
||||
entrypoint: >
|
||||
sh -c "export POSTGRES=\"postgres://docs:$$(node -e 'process.stdout.write(encodeURIComponent(require(\"fs\").readFileSync(\"/run/secrets/postgres_p\",\"utf8\").trim()))')@db:5432/yhub\" && node node_modules/@y/hub/bin/init-db.js && exec /usr/local/bin/entrypoint \"$$@\"" --
|
||||
sh -c "while [ ! -s /keys/yhub-jwt.pem ]; do sleep 1; done; export POSTGRES=\"postgres://docs:$$(node -e 'process.stdout.write(encodeURIComponent(require(\"fs\").readFileSync(\"/run/secrets/postgres_p\",\"utf8\").trim()))')@db:5432/yhub\" && node node_modules/@y/hub/bin/init-db.js && exec /usr/local/bin/entrypoint \"$$@\"" --
|
||||
command: ["node", "--import", "./dist/sentry.js", "dist/server.js"]
|
||||
volumes:
|
||||
- jwt_keys:/keys:ro
|
||||
secrets:
|
||||
- postgres_p
|
||||
- y_api_key
|
||||
- yhub_jwt_pk
|
||||
- minio_ru
|
||||
- minio_rp
|
||||
|
||||
@@ -242,9 +246,42 @@ services:
|
||||
labels:
|
||||
backupbot.backup: "${ENABLE_BACKUPS:-true}"
|
||||
|
||||
# Generates the two RSA keys the backend and yhub sign with, into a shared volume.
|
||||
# They cannot be abra-generated secrets (PEM format) and Swarm secrets cannot be
|
||||
# created at deploy time, so this idempotent sidecar creates them once and keeps them
|
||||
# on the volume across redeploys. Both consumers wait for their file before starting.
|
||||
jwt-keys:
|
||||
image: lasuite/impress-yhub:v6.0.2
|
||||
networks:
|
||||
- backend
|
||||
user: "0"
|
||||
volumes:
|
||||
- jwt_keys:/keys
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "[ -s /keys/jwt.pem ] && [ -s /keys/yhub-jwt.pem ]"]
|
||||
interval: 15s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 10s
|
||||
entrypoint: ["/bin/sh", "-c"]
|
||||
command:
|
||||
- |
|
||||
set -eu
|
||||
generate() {
|
||||
target="/keys/$$1"
|
||||
if [ ! -s "$$target" ]; then
|
||||
node -e 'const fs=require("fs");const {generateKeyPairSync}=require("crypto");const {privateKey}=generateKeyPairSync("rsa",{modulusLength:2048,publicKeyEncoding:{type:"spki",format:"pem"},privateKeyEncoding:{type:"pkcs8",format:"pem"}});fs.writeFileSync(process.argv[1],privateKey,{mode:0o400});' "$$target"
|
||||
fi
|
||||
}
|
||||
generate jwt.pem
|
||||
generate yhub-jwt.pem
|
||||
chown -R "${DOCKER_USER:-1000}:${DOCKER_USER:-1000}" /keys
|
||||
chmod 0400 /keys/jwt.pem /keys/yhub-jwt.pem
|
||||
while true; do sleep 3600; done
|
||||
|
||||
# Conversion service only since v6 (no longer serves the collaboration)
|
||||
y-provider:
|
||||
image: lasuite/impress-y-provider:v6.0.1
|
||||
image: lasuite/impress-y-provider:v6.0.2
|
||||
networks:
|
||||
- backend
|
||||
healthcheck:
|
||||
@@ -263,12 +300,12 @@ services:
|
||||
- y_api_key
|
||||
|
||||
docspec:
|
||||
image: ghcr.io/docspecio/api:3.0.2
|
||||
image: ghcr.io/docspec/api:1.21.4
|
||||
networks:
|
||||
- backend
|
||||
healthcheck:
|
||||
# Use 127.0.0.1, which is required instead of localhost for this healtcheck because of elixir/busybox bindings
|
||||
test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:4000/health"]
|
||||
test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:3000/health"]
|
||||
interval: 15s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
@@ -343,7 +380,7 @@ services:
|
||||
- minio_ru
|
||||
|
||||
web:
|
||||
image: nginx:1.31.7
|
||||
image: nginx:1.31.8
|
||||
healthcheck:
|
||||
test: ["CMD", "curl", "-f", "http://localhost:8083"]
|
||||
interval: 15s
|
||||
@@ -380,6 +417,7 @@ volumes:
|
||||
postgres:
|
||||
minio:
|
||||
yhub_valkey:
|
||||
jwt_keys:
|
||||
|
||||
configs:
|
||||
nginx_conf:
|
||||
@@ -412,12 +450,6 @@ secrets:
|
||||
postgres_p:
|
||||
external: true
|
||||
name: ${STACK_NAME}_postgres_p_${SECRET_POSTGRES_P_VERSION}
|
||||
jwt_pk:
|
||||
external: true
|
||||
name: ${STACK_NAME}_jwt_pk_${SECRET_JWT_PK_VERSION}
|
||||
yhub_jwt_pk:
|
||||
external: true
|
||||
name: ${STACK_NAME}_yhub_jwt_pk_${SECRET_YHUB_JWT_PK_VERSION}
|
||||
minio_rp:
|
||||
external: true
|
||||
name: ${STACK_NAME}_minio_rp_${SECRET_MINIO_RP_VERSION}
|
||||
|
||||
Reference in New Issue
Block a user